diff options
| author | Takashi Sakamoto <o-takashi@sakamocchi.jp> | 2016-02-05 09:56:05 +0900 |
|---|---|---|
| committer | Takashi Iwai <tiwai@suse.de> | 2016-02-05 12:45:59 +0100 |
| commit | 5d2560a427fc7c4050a320be62c4994705ca81b1 (patch) | |
| tree | 6c21aa2c9b4f5414faff3f3d46ed46cfbfe48814 | |
| parent | 360a8245680053619205a3ae10e6bfe624a5da1d (diff) | |
| download | linux-stable-5d2560a427fc7c4050a320be62c4994705ca81b1.tar.gz linux-stable-5d2560a427fc7c4050a320be62c4994705ca81b1.tar.bz2 linux-stable-5d2560a427fc7c4050a320be62c4994705ca81b1.zip | |
ALSA: firewire-tascam: fix NULL pointer dereference when model identification fails
When unsupported models are connected, snd-firewire-tascam module causes
NULL pointer dereference in fw_core_remove_address_handler() (due to
list_del_rcu()).
This commit prevents this bug.
Signed-off-by: Takashi Sakamoto <o-takashi@sakamocchi.jp>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
| -rw-r--r-- | sound/firewire/tascam/tascam-transaction.c | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/sound/firewire/tascam/tascam-transaction.c b/sound/firewire/tascam/tascam-transaction.c index 904ce0329fa1..040a96d1ba8e 100644 --- a/sound/firewire/tascam/tascam-transaction.c +++ b/sound/firewire/tascam/tascam-transaction.c @@ -230,6 +230,7 @@ int snd_tscm_transaction_register(struct snd_tscm *tscm) return err; error: fw_core_remove_address_handler(&tscm->async_handler); + tscm->async_handler.callback_data = NULL; return err; } @@ -276,6 +277,9 @@ void snd_tscm_transaction_unregister(struct snd_tscm *tscm) __be32 reg; unsigned int i; + if (tscm->async_handler.callback_data == NULL) + return; + /* Turn off FireWire LED. */ reg = cpu_to_be32(0x0000008e); snd_fw_transaction(tscm->unit, TCODE_WRITE_QUADLET_REQUEST, @@ -297,6 +301,8 @@ void snd_tscm_transaction_unregister(struct snd_tscm *tscm) ®, sizeof(reg), 0); fw_core_remove_address_handler(&tscm->async_handler); + tscm->async_handler.callback_data = NULL; + for (i = 0; i < TSCM_MIDI_OUT_PORT_MAX; i++) snd_fw_async_midi_port_destroy(&tscm->out_ports[i]); } |